Information disclosure in Microsoft Windows and Windows Server - CVE-2017-0190

Vulnerability identifier: #VU6451

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-0190

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper handling of objects in memory by the Windows Graphics Device Interface (GDI). An authenticated attacker can run a specially crafted application, trigger memory corruption and retrieve information from a targeted system.

Successful exploitation of the vulnerability results in information disclosure.

Microsoft Windows
Windows Server

Install update from vendor's website.

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0190

• Information disclosure in Microsoft Windows GDI